German Court Ruling Puts Mandatory Training Records Under Legal Scrutiny

A decision from Germany’s Federal Labor Court has thrown the reliability of training attendance documentation into doubt, forcing companies to rethink how they prove workers received legally required instruction.

The ruling, issued on May 7, 2026 (case number 2 AZR 184/25), centered on an employer who could not conclusively demonstrate that an employee had received an invitation to mandatory training. The court found that the previous scanning procedure used for registered mail did not establish sufficient prima facie evidence that the item had actually been delivered.

In response, Deutsche Post updated its delivery process in July 2026, introducing version 4.0. Under the new system, the postal carrier now digitally confirms delivery with their name and signature — but only after the item has been dropped off. Legal experts remain cautious, noting that courts have yet to formally validate this revised method as acceptable prima facie evidence. For critical documents, attorneys continue to recommend in-person handover or courier delivery.

Proving compliance with training and safety requirements is a challenge for any employer. A free toolkit with 41 ready-to-use templates helps you document risk assessments and safety procedures in a way that stands up to scrutiny. Download the free Risk Assessment Toolkit

Phishing Training Under Fire From Academic Research

While the court decision complicates administrative compliance, separate scientific findings are challenging the effectiveness of the training itself. A field experiment conducted by the University of Chicago found no measurable link between annual cybersecurity training sessions and reduced errors during simulated phishing attacks. Even more sobering: studies within U.S. healthcare organizations showed only a 1.7 percentage point improvement in detection rates.

Research presented at USENIX Security 2024 suggests that incorrect responses during testing can raise employee stress levels and erode confidence in IT security systems. An analysis published at USEC 2025 added a troubling finding: individuals who have previously fallen for phishing attempts are statistically more likely to be deceived again.

The takeaway for businesses: training alone is insufficient. Specialists recommend layering technical defenses such as email gateways using DMARC, DKIM, and SPF protocols, implementing a four-eyes principle for financial transactions, and deploying clear warning banners.

NIS-2 Puts Boardrooms on Notice

Regulatory pressure has intensified considerably. The NIS2 implementation act, presented in September 2025 (German parliamentary document BT-Drs. 21/1501), imposes extensive monitoring obligations and places direct responsibility on executive leadership. Sections 30 and 38 of the revised BSI Act specifically require management to demonstrably oversee compliance measures.

Deadlines are already approaching in certain sectors. Medical and psychotherapy practices must comply with the IT security directive under Section 390 of the German Social Code V — by October 2025 for those regulated by the National Association of Statutory Health Insurance Physicians, and by January 2026 for those under the National Association of Statutory Health Insurance Dentists. The Federal Office for Information Security has published implementation roadmaps focusing on basic security measures like access controls and email protection.

Municipal utilities and energy suppliers with more than 50 employees or annual revenue exceeding €10 million face additional requirements. The NIS-2 directive mandates detailed documentation of audit trails and training obligations under Article 21, paragraph 2.

Cyber Resilience Becomes a Governance Priority

Industry experts increasingly stress that cybersecurity is not merely an IT concern but a governance issue. Experience with the Digital Operational Resilience Act in the financial sector reveals that over 50 percent of security incidents originate with third-party IT providers. This finding carries direct implications for NIS-2 implementation across industrial sectors.

Companies must therefore identify critical dependencies within their supply chains, actively manage and monitor third-party vendors, and design processes that can withstand audit scrutiny.

Meeting regulatory obligations like NIS-2 requires a solid foundation of workplace safety and compliance documentation. A comprehensive health and safety toolkit gives you the risk assessments, checklists and templates you need to stay compliant with UK regulations. Download the free Health & Safety Toolkit

Starting in August 2026, stricter labeling requirements for AI-generated content take effect. Practical experience with vulnerability scanning shows that while AI increases the volume of reported issues, manual verification remains a bottleneck. Specialists recommend a three-stage validation process for security vulnerabilities to maintain report quality.

en | boerse | 69877374 |